Firefox Extension Allows Anyone to Steal Logins over Insecure Networks

[malexous]

A newly released Firefox extension, allows virtually anyone to hijack other people's accounts on popular websites like Facebook or Twitter, when connected over open wireless networks and not using HTTPS.
...

Firefox Extension Allows Anyone to Steal Logins over Insecure Wireless Networks - Softpedia

 

[roban]

Thanks for the heads up.

 

[slam]

Yup, I heard about this, but there's also a counter firefox entension that prevents this. It's generally not a good idea to go on sites that require login through public unsecure networks anyway.

 

[mckillwashere]

Facebook/Twitter Now Less Secure

Hacking into someone else’s Facebook or Twitter account is now as easy as installing a browser extension. Firesheep is a new Firefox extension designed to hijack sessions belonging to 26 online services, including Amazon, Facebook, Foursquare, Google, Twitter, and Yahoo. The packet sniffing tool springs into action the moment someone logs in to any of the supported sites over an open Wi-Fi connection

Firefox Extension Hijacks Facebook and Twitter Sessions over Open Wi-Fi | Maximum PC

 

[Anak]

An alert for wi-fi users....

I do not use wi-fi, and did not see anything in search about this, but I wanted anyone that does use wi-fi to be aware.

Firesheep has made it possible for any moron to raid your Web use, but there are ways you can stop it. Here are a few of them.

More here:Five Ways to Shear Firesheep | ZDNet


GRC's take on the subject

What any open hotspot can do to protect its users…

Instant Hotspot Protection from “FireSheep” | Steve*(GRC) Gibson's Blog

And....

At Noon on Sunday, October 24th, 2010, during the final day of the 12th annual Toorcon Security Conference held in San Diego, two Seattle, Washington-based hackers, Eric Butler and Ian Gallagher, brought web session hijacking to the masses

Why Firesheep’s Time Has Come | Steve*(GRC) Gibson's Blog

 

[timofort]

Well : it's time to extend https wider than existing secure web sites, isn't it ?

In my own country, the web customer area of my ISP was still http about 6 months ago, knowing that I authenticate it with my internet connection login and password. Do you believe it ?

 

[Anak]

Well : it's time to extend https wider than existing secure web sites, isn't it ?

In my own country, the web customer area of my ISP was still http about 6 months ago, knowing that I authenticate it with my internet connection login and password. Do you believe it ?

Yes I believe it.
I can not find a link to verify it now, but there have been reports that wi-fi hotspot owners will harvest the log-ins to sell later to bot-net operators.

Here's F-secure's take on the subject, in a country near you:
F-Secure Weblog : News from the Lab

 

[lorddenis]

open Wi-Fi connection ? that means that the one who is trying to do this has to be near your WI-FI?

 

[Anak]

Hi ld,

As I said earlier, I don't work with wi-fi, but I would think there would be a range limit.

It been known that people will drive around in their cars to hunt down signals.
You can inadvertently pick up a neighbors.
My water meter is read by a person riding around in a Co. truck.
The power Co. reads my usage, and that reading is sent back through the transmission lines.

The power Co. example reminds me of DSL on the phone lines.

 

[JMH]

Firesheep author takes backhanded pot-shot at free speech

Two weeks ago, an automatic session-hijacking plugin was released for Firefox. It was named Firesheep, and it's been downloaded over 600,000 times so far.

The decision to release Firesheep publicly is a controversial one. On the good side, it's reminded people that some of their common web surfing habits are dangerously insecure.

Many websites use HTTPS (secure HTTP) for login, which protects your password. But they revert to insecure HTTP for the rest of the session. After you have logged in, security relies on the browser sending a session cookie - a secret authentication token - in every request.

Websites which send session cookies in unencrypted HTTP requests are exposing your login credentials - albeit only for one session - to anyone else nearby on the network. If you're on an unencrypted WiFi connection, for example at a local coffee bar, then anyone within range of the WiFi access point can hijack your login.
Since Firesheep proves just how dangerous it is to send session cookies in insecure network packets, it is likely to push businesses such as Facebook and Twitter to adopt HTTPS as an all-session default much sooner than they might otherwise have done.

'
More -
Firesheep author takes backhanded pot-shot at free speech | Naked Security

 

[Fayla]

Really, you should never visit important web sites that require login or shop online while your computer is connected to an unsecured wifi hot spot.

...I installed a counter Firefox addon for this after hearing about it and it just forced TLS on certain web-sites-- and that produced errors in my browser, as some sites rejected the TLS connection outright.

But I did realize something, if you have the noscript addon installed, you don't need an additional addon to stop this. Simply by going into the options of noscript > Advanced > HTTPS, you can define which web-sites you want to force a SSL connection on and even have Firefox encrypt all the cookies you send over SSL for certain web-sites (in case you drop out of secure mode for some reason.)

 

[Tepid]

This is not going to change much of anything.

The largest majority of users on the Net are not security conscious. If they were, there would be far fewer Virus/Malware/Spyware issues than there are.

Sorry, people in general don't give a crap as long as they can login at a starbucks for free and get their latte.
And as for Facebook and the ilk (i mean like), those people are even dumber.
Why do I say that? Simple.

When people insist on continuing to use a site that has a habit of marking all of your private data not private till you go in and change it, leaving it wide open for all to see? Your an idiot. And you deserve what you get. Sorry if that is too blunt for some, but facts are facts. It's a completely stupid thing to continue using such site. And if you are doing it? Well, as they say, "If the shoe fits."

 

[Borg 386]

Protecting yourself from the Firesheep extension

Derek Schauland took the Firesheep extension for Firefox out for a spin, and discovered how easy it makes stealing credentials on open wireless networks. Here is his take on how to protect yourself.

Read more

Hacking made easy: Protecting yourself from the Firesheep extension | IT Security | TechRepublic.com

 

[Fayla]

It's more like what can these major web-sites do to protect their end users. Not enough sites offer encryption across the board.

Really, this is a new face to a old problem. The network we use now was designed over twenty years ago and it had the goal of open-ness in mind, not security.

SSL, TLS, certificates are nothing but patchwork to try to secure a system that was designed to be completely open and security-less.

 

[madtownidiot]

The best thing you can do to protect your privacy when using a laptop in a public place is to use a VPN. If you don't want to pay for a VPN service, you can create a VPN server at home or set your home computer up for remote access.

 

[richc46]

FireFox Extension Firesheep Lets Hackers Get Into Your Social Accounts

Just found out about this security threat. It made me concerned and I dont even use hot spots
Firesheep In Wolves’ Clothing: Extension Lets You Hack Into Twitter, Facebook Accounts Easily

 

[madtownidiot]

Firesheep isn't even the half of it.. just an example made written by a skilled hacker to demonstrate one aspect of the vulnerabilities of public wifi.

 

[jimbo45]

Yup, I heard about this, but there's also a counter firefox entension that prevents this. It's generally not a good idea to go on sites that require login through public unsecure networks anyway.

?

How then do you login to an Online Bank via the Internet.

Most Banks have decent security but to reach their sites you still have to use the public internet -- so I'm confused as to what you actually mean here about logging in via public unsecure networks -- after all isn't the Internet just one gigantic public Network.

Cheers
jimbo

 

[RJ12]

Yup, I heard about this, but there's also a counter firefox entension that prevents this. It's generally not a good idea to go on sites that require login through public unsecure networks anyway.

?

How then do you login to an Online Bank via the Internet.

Most Banks have decent security but to reach their sites you still have to use the public internet -- so I'm confused as to what you actually mean here about logging in via public unsecure networks -- after all isn't the Internet just one gigantic public Network.

Cheers
jimbo

I believe they mean unsecured WiFi Networks

 

[swarfega]

So is there an extension you can install to counter this? Can other extension based browsers suffer from this as well?

Firefox is getting more and more insurecure.